{"id":2595,"date":"2026-10-31T10:47:13","date_gmt":"2026-10-31T10:47:13","guid":{"rendered":"https:\/\/berenkudaygorun.com\/blog\/?p=2595"},"modified":"2026-10-31T10:47:15","modified_gmt":"2026-10-31T10:47:15","slug":"portswigger-authentication-lab-14-2fa-bypass-using-a-brute-force-attack","status":"publish","type":"post","link":"https:\/\/berenkudaygorun.com\/blog\/blog\/2026\/10\/31\/portswigger-authentication-lab-14-2fa-bypass-using-a-brute-force-attack\/","title":{"rendered":"PortSwigger Authentication Lab 14: 2FA Bypass Using a Brute-force Attack"},"content":{"rendered":"\n

Bu labda, PortSwigger Web Security Academy\u2019nin Authentication kategorisindeki \u201c2FA bypass using a brute-force attack\u201d senaryosunu inceliyoruz. Kullan\u0131c\u0131 ad\u0131 ve parolas\u0131 bilinen bir hesab\u0131n iki fakt\u00f6rl\u00fc kimlik do\u011frulama ad\u0131m\u0131, do\u011frulama koduna brute-force uygulanmas\u0131na kar\u015f\u0131 zafiyet i\u00e7eriyor. Amac\u0131m\u0131z, Burp makrolar\u0131yla giri\u015f s\u00fcrecini otomatikle\u015ftirerek d\u00f6rt haneli 2FA kodunu brute-force ile bulmak ve carlos kullan\u0131c\u0131s\u0131n\u0131n hesap sayfas\u0131na eri\u015fmek. Lab ba\u011flant\u0131s\u0131<\/a>.<\/p>\n\n\n\n

Lab i\u00e7erisinde carlos:montoya credential’lar\u0131 bize verilmi\u015f ancak sistemde bir de 2FA oldu\u011funu belirtiyor. 2FA i\u00e7in bize bir kod gelmeyecek ama buran\u0131n zafiyetli oldu\u011funu belirtmi\u015f. \u0130lk denemeleri yapal\u0131m.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Giri\u015f yapt\u0131ktan sonra bu \u015fekilde bir ekran bizi kar\u015f\u0131l\u0131yor ve olu\u015fan istek bu \u015fekilde. E\u011fer hatal\u0131 girersek sonu\u00e7 a\u015fa\u011f\u0131daki gibi oluyor.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Birka\u00e7 denemeden sonra CSRF hatas\u0131 almaya ba\u015flad\u0131m. Bundan dolay\u0131, hem ilk ba\u015fta GET iste\u011fi at\u0131p daha sonras\u0131nda Set-Cookie ile cookie’yi sonraki POST iste\u011finde g\u00fcncelleyip daha sonras\u0131nda POST iste\u011finde at\u0131lan CSRF de\u011ferini yeni CSRF de\u011feri ile g\u00fcncelleyece\u011fim bir \u015fekilde ilerlemem gerekiyordu.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Buradaki 4 digit security code’un her seferinde tekrar \u00fcretildi\u011fine dair bir ifade ya da bir i\u015faret yok. Bundan dolay\u0131 buradaki sistemi otomatize edip brute-force yapmaya karar verdim.<\/p>\n\n\n\n

Bunun i\u00e7in Burp i\u00e7erisindeki session handling’i kullanaca\u011f\u0131z.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u00d6nce Proxy > Settings > Session > Session Handling Rules > Add > Scope > Include all URLs yapal\u0131m ki rahat olsun. Ayn\u0131 zamanda burada scope k\u0131sm\u0131nda Extensions’\u0131 da se\u00e7iniz \u00e7\u00fcnk\u00fc Turbo Intruder kullanaca\u011f\u0131z.<\/p>\n\n\n\n

Arka arkaya atmak istedi\u011fimiz istekleri se\u00e7iyoruz.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u0130sterseniz test edebilirsiniz, CSRF ve cookie’yi ba\u015far\u0131l\u0131 bir \u015fekilde handle etti\u011fini g\u00f6rebilirsiniz.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u0130lk olu\u015fturdu\u011fumuz kurala art\u0131k makromuzu a\u015fa\u011f\u0131daki gibi ekleyebilirsiniz.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Repeater’da testlerim esnas\u0131nda Burp, MFA’y\u0131 da de\u011fi\u015ftirmeye \u00e7al\u0131\u015f\u0131yordu. Bu y\u00fczden bir ince ayar yapmam\u0131z gerekti.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

mfa-code parametresini except et dedik.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Tekrar denedi\u011fimde her \u015fey yolundayd\u0131… Art\u0131k Turbo Intruder’a atabiliriz. Kodum a\u015fa\u011f\u0131daki gibiydi… Burada \u00f6nemli olan makrolar\u0131n scope’undan yararlanabilmek i\u00e7in engine=Engine.BURP kullanman\u0131zd\u0131r.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u015eimdi \u00e7al\u0131\u015ft\u0131ral\u0131m…<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u015eimdi bu session ile bu adrese gidelim.<\/p>\n\n\n\n

\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"

Bu labda, PortSwigger Web Security Academy\u2019nin Authentication kategorisindeki \u201c2FA bypass using a brute-force attack\u201d senaryosunu inceliyoruz. Kullan\u0131c\u0131 ad\u0131 ve parolas\u0131 bilinen bir hesab\u0131n iki fakt\u00f6rl\u00fc…<\/p>\n

Devam\u0131n\u0131 okuPortSwigger Authentication Lab 14: 2FA Bypass Using a Brute-force Attack<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[749],"tags":[393],"class_list":["post-2595","post","type-post","status-publish","format-standard","hentry","category-web","tag-authentication","entry"],"_links":{"self":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2595","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/comments?post=2595"}],"version-history":[{"count":1,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2595\/revisions"}],"predecessor-version":[{"id":2608,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/posts\/2595\/revisions\/2608"}],"wp:attachment":[{"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/media?parent=2595"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/categories?post=2595"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/berenkudaygorun.com\/blog\/wp-json\/wp\/v2\/tags?post=2595"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}